CVE-2026-81389: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81389) is a heap-based buffer overflow in Microsoft Office Excel, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of the affected system. The CVSS 3.1 vector indicates local attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Multiple version ranges of Microsoft 365 Apps for Enterprise are affected, with patches provided by Microsoft. The vendor advisory confirms the availability of an official fix and that this is a published vulnerability.

Successful exploitation allows an attacker to execute arbitrary code locally on the affected system, which can lead to full compromise of confidentiality, integrity, and availability of the system running Microsoft 365 Apps for Enterprise Excel. The vulnerability requires local access and user interaction, and the attack complexity is high.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81389. Since this is a cloud service component, Microsoft manages remediation for cloud-hosted services. No known exploits are currently in the wild.